Up: Payload Detection Rule Options
The http_raw_uri keyword is a content modifier that restricts the search to the
UNNORMALIZED request URI field .
As this keyword is a modifier to the previous content keyword, there must be
a content in the rule before http_raw_uri is specified.